CVE-2026-89205
6.3MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-602
Impact
Authenticated attackers with low privileges can schedule unauthorized operations on managed devices. They need network access to the CROSSBOW server and valid low-privilege credentials.
Root cause
The server fails to perform server-side authorization checks on requests that schedule special operations.
Affected systems
RUGGEDCOM CROSSBOW all versions prior to V6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
Upgrade RUGGEDCOM CROSSBOW to V6.0 or later. If patching immediately is not possible, restrict network access to the CROSSBOW management interface to trusted hosts and audit scheduled tasks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attacker with minimal privileges to schedule unauthorized operations on devices.